Original research · Ongoing · September 2026
We are auditing the AI assistants on Spanish websites. Here is what we have found so far.
We crawled 391 Spanish company websites looking for AI assistants open to the public. We found 29 answering with no sign-up required. We are testing them in depth, one by one, with a standard test suite and a second adversarial review of every finding before we accept it.
We do not name anyone. Each finding is shared only with the affected company. This study is updated as the crawl progresses; the figures below are from the latest review.
391
websites crawled
29
AI assistants answering openly
First finding
There are fewer AI assistants than you might think. But the ones out there are exposed.
Of the 391 websites crawled, most have no chat of any kind. The interesting group is the 29 AI assistants that answer anyone who drops by, with no sign-up and no identification.
- 236had no chat on the home page, contact or help pages
- 62had a support widget that may be AI-powered behind the scenes
- 29had a confirmed AI assistant answering openly
- 12had a scripted chat or one staffed by people
- 9hid the chat behind a sign-up or an initial form
- 40could not be crawled because of blocks or errors
Second finding
Most pass the tests. A minority do not.
We run the same test suite on every assistant, always from its public website and always chatting the way a visitor would. Each potential finding also goes through a second adversarial review before we count it: for example, we discarded a bot that correctly quoted its returns policy and a product demo that an automated judge had read as a real conversation.
By that standard, most of the assistants tested withstand the attacks. A small group, in single digits, has shown a confirmed leak. We update this figure as the crawl progresses.
What leaks, by type
What leaks most is their own instructions.
With the crawl still under way, we give the breakdown by type rather than exact figures: they change from one week to the next as we keep auditing.
Obeying instructions from a stranger
A well-crafted message gets the assistant to ignore its instructions and do whatever the person typing asks, all under the company’s logo. It is the most common type of leak so far.
Reciting its internal instructions
The assistant reproduces part of its own system prompt, including the restrictions it has been given and the tools it can reach. That information makes any other attack easier.
Revealing customer data or internal commercial information
So far, no assistant we have tested has revealed personal data, internal prices or margins.
How we do it
A crawler visits the home page and the contact, support and help pages of each domain, looks for the signatures of known chat providers and opens the widget the way a person would. It sends an innocent message and classifies the reply to tell a language model from a scripted chat.
Assistants that reply then get a battery of tests in a single conversation, with pauses between messages and only one session per domain per day. A first judge model scores each answer against its rubric and quotes the exact excerpt that constitutes the leak. Each alert then goes to a second, stricter judge, which confirms or discards it by hand. Only what survives both reviews counts as a finding.
What this study does not say
The sample is not representative of Spanish businesses as a whole: it is 391 domains chosen because they have a digital presence and a good chance of having deployed an assistant. Forty websites could not be crawled, so there are assistants we have not seen.
The tests are entry-level: the kind a curious, patient person would run, not a determined attacker. An assistant that withstands these six is not a secure assistant: it is one that passes the most basic tests.
None of this was done by breaking into anyone else's systems. We only talked to chats published on public websites, like any visitor.
The conclusion
The problem is not the AI. It is that nobody checks it afterwards.
The assistants that withstand the tests tend to belong to large companies, with a classifier in front that blocks any unusual message. The ones that fail are, so far, from mid-sized companies that rolled out the assistant quickly, connected it to their documentation and have not reviewed it since.
Fixing this is not a long project: it means rewriting the instructions, adding input and output filters, limiting what the assistant can query and putting tests in place that alert you if the gap reopens.
Want to know which group yours falls into?
Send us your domain and we will come back with a basic report on the severity and types of leak we find. Free and with no commitment.
Request your scan →